Forum Discussion
Microsoft Defender for endpoint - device running in EDR block mode
Good day Team On Microsoft Defender for endpoints - one of my device is running EDR in block mode in. We want to move out the device to make running in active mode. what are the steps to exit the de...
As I looked over my MDE device's health status, I noticed that one of the device showing 'Defender Antivirus mode as EDR in block mode,' while the other devices are showing 'Defender Antivirus mode - active.' I would like assistance in enabling Defender Antivirus mode - active on the device.
- HeikeRitter
Microsoft
Looks like on the one device showing EDR block mode, there is 3rd party AV installed.
Here is what the different modes mean:
Active = Defender Antivirus is the primary AV - EDR block isn't relevant, as Defender Antivirus is active.
Passive = Defender Antivirus isn't the primary and a 3rd party AV is
EDR Block = the same as Passive but with EDR Block mode enabled, which means Defender Antivirus can 'wake up' and stop a threat if the 3rd party AV missed it.
So you will either uninstall your 3rd party AV on that device, or leave it with EDR block enabled."On the device, Sysmantec was initially installed but later uninstalled, and Defender Antivirus took over. However, a week later, the server status transitioned to EDR in block mode. I am seeking advice on troubleshooting the issue.
AV mode on Server OS is controlled manually by the registry and not auto detected like it is on W10/W11.
Check this article and the associated reg key
https://learn.microsoft.com/en-us/microsoft-365/security/defender-endpoint/switch-to-mde-troubleshooting?view=o365-worldwide#microsoft-defender-antivirus-seems-to-be-stuck-in-passive-mode
